GHSA-27v7-qhfv-rqq8 Insecure Credential Storage in web3
Attackers can steal private keys from local storage if a Cross-Site Scripting vulnerability exists in the application using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is GHSA-27v7-qhfv-rqq8?
GHSA-27v7-qhfv-rqq8 is a vulnerability in web3, published on 30 May 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of web3 are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.
Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
Which versions are affected by GHSA-27v7-qhfv-rqq8?
2 open source packages ship an affected version, including web3.
| Package | Affected | Fixed in |
|---|---|---|
web3 npm | All versions to 1.5.2 | None |
web3 npm | All versions to 1.5.2 | None |
How do I fix GHSA-27v7-qhfv-rqq8?
No fix has been published for GHSA-27v7-qhfv-rqq8 yet. Limit exposure of the affected software until one is available.
Is GHSA-27v7-qhfv-rqq8 being exploited?
There is no known exploitation of GHSA-27v7-qhfv-rqq8 in the wild and no public exploit code.